Securing a Virtual Network
with Azure Firewall
Introduction
Securing a network’s perimeter
is one of the most important aspects of a cloud engineer's role.
This blog will demonstrate
a common,
real-world experience regarding
this task. Here what I will do is I will build a network topology and
then experience configuring and deploying Azure Firewall,
before traversing it from the
internet using a real-world scenario of network address translation.
we'll need to test the Azure Firewall configuration. To do so, use the Remote Desktop client (available from Microsoft for Windows clients natively and Mac clients here).
Solution
Log in to the Azure Portal
Create a Virtual Network
Set the following values:
Name: SpokeVnet1
Address space: 10.10.10.0/24
Resource group: rakeshrg
Location: NorthEurope
Address range: 10.10.10.0/26
Click Create.
Create Network Security Group
Navigate to All services >
Network security groups.
Click Create network security
group.
Set the following values:
Name: "SpokeNSG1"
Resource group:
Location:
Click Create.
Once it's deployed, click the
name of the NSG.
Click Subnets
Click Associate.
Click Virtual network and
select our listed virtual network.
Click Subnet and select
default.
Click OK.
Create a Virtual Machine
Click Virtual machines in the
left-hand menu.
Click Create virtual machine,
and set the following values:
Resource group: Select the one
listed in the dropdown
Virtual machine name: Anything
you'd like (e.g., "SpokeServer1")
Region: Select the one listed
in the dropdown
Image: Windows Server 2019
Size: B2s Standard
Username: Anything
Password: X*****X
Click Next: Disks.
Leave settings as-is and click
Next: Networking.
Set the Virtual network to the
one we previously created.
Set Public IP to None.
Click Next: Management.
Set Boot Diagnostics to Off.
Click Next: Advanced > Next:
Tags > Next: Review + create.
Click Create.
Create a Second Virtual Network
and Azure Firewall
Navigate to Virtual networks in
the left-hand menu and click Create virtual network.
Set the following values:
Name: HubVnet1
Address space: 10.10.200.0/24
Resource group: rakeshrg
Location: NorthEurope
Address range: 10.10.200.0/26
Firewall: Enabled
Firewall name: Anything you'd
like (e.g., "Firewall1")
Firewall subnet address space:
10.10.200.64/26
Click Create.
Peer the Virtual Networks
Together and Create a Route Table
Click HubVnet1.
Click Peerings > Add.
Set the following values:
Name of the peering from
HubVnet1 to remote virtual network: HubToSpokePeer
Virtual network: SpokeVnet1
Name of the peering from
SpokeVnet1 to HubVnet1: SpokeToHubPeer
Enable every peering option except
gateway transit.
Click OK.
Navigate to All services >
Route tables.
Click Create route table, and
set the following values:
Name: Anything you'd like
(e.g., "DefaultRoute")
Resource group: Select the one
listed in the dropdown
Location: The same location as
before
Click Create.
Once it's deployed, click its
name.
Click Routes > Add.
Set the following values:
Route name: Anything you'd like
(e.g., "DefaultRoute1")
Address prefix: 0.0.0.0/0
Next hope type: Virtual
appliance
Next hop address: 10.10.200.68
Click OK.
Click Subnets.
Click Associate.
Click Virtual network and
select SpokeVnet1.
Click Subnet and select
default.
Click OK.
Allow Remote Desktop Protocol
Traffic through the Azure Firewall and the Network Security Group
Navigate to All services >
Firewalls.
Click the firewall we created
earlier.
Click Public IP Configuration,
and copy and paste its listed public IP address into a text editor since we'll
need it in a bit for configuration.
Click Rules.
Click Add NAT rule collection,
and set the following values for the rule collection:
Name: Anything you'd like
(e.g., "RDPForward")
Priority: Any number between
100 and 50000
In the Rules section, set the
following values:
Name: Anything you'd like
(e.g., "RDPtoSpoke")
Protocol: TCP and UDP
Source Addresses: Can be a
wildcard (*) or your public IPv4 address (which you can get by querying Google)
Destination Addresses: The
public IP address of the firewall we copied earlier
Destination Ports: 3389
Translated Address: 10.10.10.4
Translated Port: 3389
Click Add.
Navigate to All services >
Network security groups.
Click the network security
group we created earlier.
Click Inbound security rules.
Click Add, and set the
following values:
Source: IP Addresses
Source IP addresses/CIDR
ranges: 10.10.200.64/26
Source port ranges: *
Destination: IP Addresses
Destination IP addresses/CIDR
ranges: 10.10.10.4
Destination port ranges: 3389
Name: Anything you'd like
(e.g., "RDPtoSpoke")
Click Add.
Test Azure Firewall
Open RDP to connect to the
public IP address of the Azure Firewall.
If it's working correctly, a
standard Windows credential pop-up should be presented.
Provide the username and
password of the virtual machine, and then click Continue.
Once connected, open an
Internet Explorer window and browse to Google.com. The response should be
similar to:-
No comments:
Post a Comment